BMC IPMI
by Supermicro
CVEs (5)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-65211 | Hig | 0.47 | 7.2 | — | Oct 27, 2026 | This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system. | ||
| CVE-2026-65213 | Med | 0.43 | 6.6 | — | Oct 27, 2026 | This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC | ||
| CVE-2026-65220 | Hig | 0.00 | 8.8 | — | Oct 27, 2026 | A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges. | ||
| CVE-2026-18450 | Cri | 0.00 | 9.8 | — | Oct 27, 2026 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | ||
| CVE-2026-18449 | Hig | 0.00 | 7.5 | — | Oct 27, 2026 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. |
- risk 0.47cvss 7.2epss —
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- risk 0.43cvss 6.6epss —
This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
- risk 0.00cvss 8.8epss —
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- risk 0.00cvss 9.8epss —
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- risk 0.00cvss 7.5epss —
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.